> ## Documentation Index
> Fetch the complete documentation index at: https://docs.atlaspay.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

Secure your API requests with API keys.

## API Keys

Atlas uses API keys to authenticate requests. You can view and manage your API keys in the [Dashboard](https://atlas.co/dashboard/api-keys).

| Key Type | Prefix        | Description                                |
| -------- | ------------- | ------------------------------------------ |
| **Test** | `sk_test_...` | Use for development. No real charges.      |
| **Live** | `sk_live_...` | Use in production. Real charges processed. |

## Making Authenticated Requests

Include your API key in the `Authorization` header as a Bearer token:

```bash theme={null}
curl -X POST https://api.atlas.co/functions/v1/create-session \
  -H "Authorization: Bearer sk_test_your_secret_key" \
  -H "Content-Type: application/json" \
  -d '{"amount": 4990, "currency": "USD"}'
```

```javascript theme={null}
const response = await fetch('https://api.atlas.co/functions/v1/create-session', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer sk_test_your_secret_key',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    amount: 4990,
    currency: 'USD'
  })
});
```

```python theme={null}
import requests

response = requests.post(
    'https://api.atlas.co/functions/v1/create-session',
    headers={'Authorization': 'Bearer sk_test_your_secret_key'},
    json={'amount': 4990, 'currency': 'USD'}
)
```

> **Warning**: Never expose your secret key in client-side code, public repositories, or client-side JavaScript. Use environment variables and server-side code to make API calls.

## Idempotency

Use idempotency keys to safely retry requests without accidentally performing the same operation twice. Include the `Idempotency-Key` header with a unique value (e.g., order ID or UUID).

```bash theme={null}
curl -X POST https://api.atlas.co/functions/v1/create-session \
  -H "Authorization: Bearer sk_test_xxx" \
  -H "Idempotency-Key: order_12345" \
  -H "Content-Type: application/json" \
  -d '{"amount": 4990, "currency": "USD"}'
```

Idempotency keys expire after 24 hours.

## Rate Limits

The API is rate limited to ensure fair usage:

| Limit               | Value   |
| ------------------- | ------- |
| Requests per minute | 1,000   |
| Requests per day    | 100,000 |
| Concurrent requests | 50      |

Rate limit headers are included in every response:

* `X-RateLimit-Limit` - Maximum requests allowed
* `X-RateLimit-Remaining` - Requests remaining in current window
* `X-RateLimit-Reset` - Unix timestamp when the limit resets